Which versions of nanoMODBUS are affected by CVE-2026-54410?

nanoMODBUS versions through v1.23.0 contain a remote unauthenticated off-by-one buffer overflow in the Modbus/TCP server, enabling attackers to cause denial of service against all deployments and…

How to fix or mitigate CVE-2026-54410?

Within 24 hours: inventory all systems running nanoMODBUS and classify by deployment type (bare-metal, RTOS, or protected OS) and network criticality. Within 7 days: restrict Modbus/TCP port 502 access via firewall rules to trusted networks only; deploy network-based IDS/IPS rules to block MBAP frames with Length field values exceeding 254 bytes. Within 30 days: prioritize migration to an actively maintained Modbus/TCP library with vendor security support; if migration is not feasible, commission code-level security hardening and input validation patches to reject malformed frames at library entry.

nanoMODBUS CVE-2026-54410

Q: What is the CVSS score of CVE-2026-54410?

CVE-2026-54410 has a CVSS 4.0 base score of 7.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-36661 HIGH

Off-by-one Error (CWE-193)

2026-06-14 TuranSec

GHSA-6f53-f2m4-6j2h

Buffer Overflow Denial Of Service Information Disclosure Nanomodbus Debevv

7.8

CVSS 4.0 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

7.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X

vuln.today AI

8.6 HIGH

Single crafted Modbus/TCP frame on port 502 with no auth or interaction (AV:N/AC:L/PR:N/UI:N); reliable DoS gives A:H while conditional one-byte leak and unintended writes give C:L/I:L.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 14, 2026 - 17:42 vuln.today

DescriptionCVE.org

nanoMODBUS through v1.23.0 contains an off-by-one buffer overflow in the recv_msg_header() function of the Modbus/TCP server that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of the 260-byte receive buffer by sending a crafted MBAP frame whose Length field is set to 255. The overflow corrupts the adjacent buffer-index field of the nanoMODBUS state structure, resulting in denial of service through invalid memory accesses and, on bare-metal and RTOS targets without memory protection, one-byte information disclosure and writes to unintended register addresses on the Write Multiple Registers (FC16) handler path.

AnalysisAI

Off-by-one buffer overflow in nanoMODBUS through v1.23.0 lets remote unauthenticated attackers write one attacker-controlled byte past a 260-byte receive buffer in the Modbus/TCP server's recv_msg_header() function. The corruption of the adjacent buffer-index field can cause denial of service on all targets and, on bare-metal/RTOS deployments without memory protection, leak one byte of memory and trigger unintended writes through the Write Multiple Registers (FC16) handler. No public exploit identified at time of analysis, but the bug is trivially reachable by sending a crafted MBAP frame with Length=255.

Technical ContextAI

nanoMODBUS (cpe:2.3:a:debevv:nanomodbus) is a lightweight, embedded-oriented C implementation of the Modbus protocol commonly deployed on microcontrollers, RTOS targets, and bare-metal industrial devices acting as Modbus/TCP servers. The root cause is CWE-193 (Off-by-One Error) in recv_msg_header() at nanomodbus.c line 369, where the MBAP (Modbus Application Protocol) header's 16-bit Length field is trusted with insufficient bound enforcement: a value of 255 causes the read to extend one byte beyond the fixed 260-byte receive buffer. Because the overflowed byte lands in the immediately-adjacent buffer-index member of the nanoMODBUS state structure (an adjacency-based corruption pattern that overlaps with CWE-787 out-of-bounds write), subsequent parsing - particularly in the FC16 Write Multiple Registers path - uses an attacker-influenced index, turning a parsing bug into a logic corruption that affects register write targeting on systems without MMU/MPU isolation.

RemediationAI

No vendor-released patch identified at time of analysis; monitor the upstream repository at https://github.com/debevv/nanoMODBUS for a release succeeding v1.23.0 and rebuild/reflash firmware once a fixed tag is published. In the interim, restrict Modbus/TCP server exposure to dedicated OT/process-control VLANs and block TCP/502 at perimeter and IT/OT boundary firewalls (Modbus has no native authentication, so network segmentation is the standard compensating control); the trade-off is that any legitimate remote engineering workstation will also lose direct reach and must be tunneled through a jump host. As a code-level workaround for integrators who cannot wait, patch recv_msg_header() locally to reject MBAP frames whose Length field exceeds the receive buffer capacity (a strict upper bound below 255 for the post-header payload) before the buffered read, which closes the off-by-one without affecting protocol conformance for valid frames. For bare-metal/RTOS targets, consider enabling MPU regions around the nanoMODBUS state structure to convert the unintended-write primitive into a fault rather than silent register corruption.